How to fix Error creating RDS DB Instance: InvalidParameterCombination in Terraform

Run Terraform with verbose logging to see the exact parameter causing issues:

TF_LOG=DEBUG terraform apply

Look for the full AWS error message in the output. AWS sometimes provides hints about which parameters conflict.

AWS deprecated t2, m4, and r4 instance types for RDS starting March 11, 2024. If you're using one of these:

resource "aws_db_instance" "example" {
  instance_class = "db.t3.micro"  # Use t3, t4g instead
  # ...
}

Replace with t3, t3a, t4g, or larger instance classes. Check AWS documentation for your engine for available options.

Explicitly specify a compatible engine version. When engine_version is omitted, AWS uses the latest version, which may not support your instance class:

resource "aws_db_instance" "example" {
  engine         = "mysql"
  engine_version = "5.7.44"  # Explicitly set version
  instance_class = "db.t3.micro"
  # ...
}

Check AWS documentation or run aws rds describe-orderable-db-instance-options to find compatible combinations.

When using provisioned IOPS storage, both allocated_storage and iops must be specified together:

resource "aws_db_instance" "example" {
  allocated_storage = 100
  storage_type     = "io1"
  iops             = 1000  # Required when storage_type is io1/io2
  # ...
}

GP2/GP3 storage has different requirements. Check AWS documentation for minimum storage sizes.

If you're enabling advanced Database Insights mode, Performance Insights must be enabled with at least 465 days retention:

resource "aws_db_instance" "example" {
  database_insights_mode                    = "advanced"
  performance_insights_enabled              = true
  performance_insights_retention_period     = 465  # Min 465 days
  performance_insights_kms_key_id          = aws_kms_key.example.arn  # KMS key required
  # ...
}

If using domain or managed authentication features, ensure the IAM role exists:

resource "aws_db_instance" "example" {
  domain               = "d-0123456789"
  domain_iam_role_name = aws_iam_role.rds_auth.name
  # ...
}

The IAM role must:
- Exist in the same AWS account
- Have trust relationship allowing RDS service
- Have policy allowing rds:DescribeDBInstances and domain-specific actions

If using a custom parameter group, ensure the family matches:

resource "aws_db_instance" "example" {
  engine                   = "mysql"
  engine_version           = "8.0.35"
  parameter_group_name     = aws_db_parameter_group.example.name
  # ...
}

resource "aws_db_parameter_group" "example" {
  family = "mysql8.0"  # Must match engine version major.minor
}

Use the AWS RDS API to check valid combinations:

aws rds describe-orderable-db-instance-options \
  --engine mysql \
  --engine-version 8.0.35 \
  --query "OrderableDBInstanceOptions[?DBInstanceClass==`db.t3.micro`]"

Or test creating the instance in the AWS Console to see if it accepts your parameters. The Console will show validation errors immediately.